For the record, the same actor appears to be doing the same thing with
Docusign through o365
Sender: DocuSign NA4 System
Reply-To: "Alina Watson"
Feedback-ID:
1:523eb52b4e53ae6db5e19a7961b3c6ae:RecipientEnvelopeComplete:Docusign_Prod
X-DS-Score: 1
From: "Alina Watson via Docusign"
On 202
On Tue, Dec 12, 2023 at 06:22:10PM -0600, Jarland Donnell via mailop wrote:
> Hey friends,
>
> Do me a favor and search your logs for this domain:
> SIBBERTLLC.onmicrosoft.com
Three hits yesterday.
> One customer received 1,347 attempted deliveries from it so far.
> Another, 823. Still counting,
It appears that Jarland Donnell via mailop said:
>Hey friends,
>
>Do me a favor and search your logs for this domain:
>SIBBERTLLC.onmicrosoft.com
It's not just that subdomain. .onmicrosoft.com is free
throwaway accounts and I've seen the Docusign phish from lots
of them.
It's kind of clever, t
Please if there's a Docusign contact here on the list, ping me offlist.
Udeme
Postmaster at LinkedIn
udeme at dot com
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
